I'm trying to write an app that will let a user see multiple Gmail inboxes at one time. I am storing the refresh token for each account in my database.
However, I would like for almost all traffic to and from Gmail to go through the browser - I don't want the unnecessary step of the server retrieving mail and sending it to the client, since I am not going to do anything with the emails server side.
This is the same (or same type of) token that the user would get if I did access token retrieval on the client. So when the user logs in, is it safe to grab an access token server side and send that to the client (over HTTPS of course)? If not, what would be the best practice here?
- I might even speculate that this is 'more' secure than storing the access token in a cookie or local storage. Users auth with my app via a JWT, then perform a GET to my server for the Gmail access token. So the Gmail access token is never stored anywhere client side. Any corrections?